* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
Download self-creating
Internet protocol suite wikipedia , lookup
Computer security wikipedia , lookup
Network tap wikipedia , lookup
IEEE 802.1aq wikipedia , lookup
Wireless security wikipedia , lookup
Piggybacking (Internet access) wikipedia , lookup
Deep packet inspection wikipedia , lookup
Computer network wikipedia , lookup
List of wireless community networks by region wikipedia , lookup
Cracking of wireless networks wikipedia , lookup
Zero-configuration networking wikipedia , lookup
Distributed operating system wikipedia , lookup
Airborne Networking wikipedia , lookup
Distributed firewall wikipedia , lookup
Routing in delay-tolerant networking wikipedia , lookup
Peer-to-peer wikipedia , lookup
Recursive InterNetwork Architecture (RINA) wikipedia , lookup
Virtual Private Ad Hoc Networking Jeroen Hoebeke, Gerry Holderbeke, Ingrid Moerman, Bard Dhoedt and Piet Demeester 2006 July 15, 2009 Overview Problem How communication is evolving towards future large-scale and high-speed, enabling interconnectivity between a massive amount of devices and users anywhere, at anytime and from any device? It Will overwhelm the user with available information, applications and services, a characteristic that is not always desired by the end user and that can result in potential security risk. It is expected that an evolution towards network virtualization will take place, imposing a logical structure onto the one large-scale IP network. Requirement & Characteristic Membership configuration and management, Distributed Operation, Security, Selforganization and mobility management, Application support, Local private address space, Ad hoc routing and tunnel management, Scalability Related Works VLAN, VPN, P2P Overlay, Virtual distributed environment(VIOLIN) Proposed Scheme Virtual private ad hoc networks(VPAN) Provide secure and self-organizing overlay networks on top of existing IP infrastructure that use ad hoc networking techniques to enable network connectivity. Challenges VPAN definition and management, Security, VPAN formation and self-organization, Addressing and routing, Member mobility management, Application middleware Problem How communication is evolving towards future large-scale and high-speed, enabling interconnectivity between a massive amount of devices and users anywhere, at anytime and from any device? It will overwhelm the user with available information, applications and services, a characteristic that is not always desired by the end user and that can result in potential security risk. It is expected that an evolution towards network virtualization will take place, imposing a logical structure onto the one large-scale IP network. The virtual networks will form a shielded and trusted environment for their participants, with its own internal routing, naming, and addressing solutions, using the underlying base network as the enabler of connectivity and carrier of data. They combine the network virtualization and ad hoc networking techniques (self-creating, self-organizing and self-administering). Requirement & Characteristic Membership configuration and management Mechanisms to initialize new VPANs and to define, configure and manage its membership information are required. Distributed Operation Distributed members discovery and VPAN formation and maintenance are required. Security Self-organization and mobility management Be able to discover each other and form a secure overlay without user intervention. Application support User should be able to specify which applications, services, data are reachable through or have access to a specific VPAN. Local private address space Each VPAN will have its own local private address space, separated from the global IP address space. why? => Applications running within a VPAN use this private address independent of changes in the global address of the node due to node mobility. Requirement & Characteristic(cont.) Ad hoc routing and tunnel management As the composition and the topology of the VPAN can be dynamic, ad hoc routing techniques will be used for efficient internal routing. In many cases links between members are logical links, spanning multiple physical hops by tunnel mechanisms. => VPAN forwarding should encompass the notion of tunnels. Scalability The number of members forming the VPAN can become quite large. Related Works VLAN VPN P2P Overlay Virtual distributed environment(VIOLOIN) Protocol stack layer Layer 2 Layer 3 Application Layer Application Layer Membership configuration and management Based on switch port or Layer 3 information. Manual, semi-automated or fully automatic configuration Statically configured in tunnel endpoints. Central tunnel management in LeetNet Running P2P software By the owner of the VIOLIN, having administrator privileges. Distributed Operation Limited to on Ethernet system. Tunnel endpoints are distributed Distributed system, sometimes supported by centralized facilities. Distributed overlay of virtual machines. Security Access based on VLAN membership. Traffic containment within VLAN. No other security mechanisms. Authentication of tunnel endpoints, confidentiality and authenticity of data transferred between these endpoint. In some case authentication, trust, anonymity, overlay access control can be offered. Depends on the network protocol used within the VIOLIN, as their packets are transferred over UDP tunnels. Self-organization and mobility management Automatically formed and maintained. Support mobility within the same Ethernet system. No mobility management. Some aspects of selforganization in dynamic VPNs. Self-organization through direct or indirect discovery of other peers for overlay formation. On-demand creation of virtual machines and the interconnecting virtual IP network. Dynamic topology adaptation possible. Related Works(cont.) VLAN Application support VPN X Local private address space(session continuity) All members share a common address space. Dynamic internal routing and tunnel management Layer2 switching, no routing involved. P2P Overlay X Depend on schemes deployed in networks behind the endpoints O Virtual distributed environment(VIOLOIN) O O Public IP addresses are used Private IP addresses are used in order to confine all communication within the VIOLIN Public IP address are used to obtain end-to-end P2P connectivity. No tunneling needed. Has Virtual routers for internal routing. Topology adaptation. Proposed Scheme Virtual private ad hoc networks(VPAN) Secure and self-organizing overlay networks on top of existing IP infrastructure that use ad hoc networking techniques to enable network connectivity. Creates a transparent, shielded and trusted environment for the applications and services running on the participants' devices. High-level Network architecture Localized VPAN All members are interconnected either wired or wireless without using any non-member nodes. High-level Network architecture(cont.) Distributed infrastructured VPAN The members are interconnected over the Internet, using nodes in the infrastructure a relay. Tunneling needed. Infrastructure support can assist the VPAN membership management, member discovery, formation, routing and mobility management. High-level Network architecture(cont.) Distributed Ad Hoc VPAN Non-member ad hoc nodes are used as relays. VPAN membership management, member discovery, formation, routing and mobility management has to be done in a completely distributed manner. High-level node architecture Middleware Firewall Content adaptation according to the capabilities of service. Convergence Layer De-multiplexing incoming packets to the corresponding VPAN and forwarding outgoing packets to the corresponding interface. Management Plane Management of the access right of the application and services. Management of the VPAN and its member Management and exchange of context and cross-layer information Data Plane Managing data Control Plane Managing VPAN configuration Challenges VPAN definition and management At first, its policies and its members, or its membership rules, to be defined. Who is the creator of the VPAN? How and where is the VPAN definition and membership information stored and/or distributed? When can the VPAN be formed and become operational? How are new members added to the VPAN(membership policies)? Member authentication? Possible Solutions Service provider, individual person. One of the members invite or request join to creator. Define membership rules and automating the process of member addition. Security Member identification and authentication Authentication of communication between VAPN members. Confidentiality of communication between VPAN members. Challenges(cont.) VPAN formation and self-organization Member discovery mechanisms form the basis of the formation of the VPAN overlay, as it is needed for secure link and tunnel establishment between member nodes. Addressing and routing Each VPAN will have its own local address space and each member is assigned one address, independent of its number of interfaces. All applications and services that communicate within the VPAN will use the local address and it is invisible to the outside world by tunneling or link encryption. When running multiple VPANs within the same device, their need to be distinguishable => Different VPAN using different address prefix. Overlay ad hoc routing depend on multiple factors: application requirements, traffic, ondemand or always-on VPAN formation, context… Member mobility management Localized VPAN Member discovery and link break detection mechanisms can improve VPAN maintenance. Other Member mobility => change of public IP address => breakdown of tunnels established between members of the VPAN overlay => require dynamic tunnel reestablishment mechanisms and interaction with the membership management or member discovery framework. Challenges(cont.) Application middleware The main functionality of this component is to act as a firewall for the resources and services at the higher layer. Provides VPAN members to be able to specify to what extent their applications and services have access to the VPAN Provides VPAN members to be able to specify to what extent other VPAN members have rights to access these applications and services. Etc Naming, QoS, context information to improve networking and management, intrusion detection, dealing with multiple or event hierarchical VPANs, traffic optimization.